CVE-2026-53976criticalCWE-22

CVE-2026-53976: critical vulnerability in Bohdan Triapitsyn OpenChamber

OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter

Published

Follow this CVE+ Monitor OpenChamber

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.3epss 2.6%
OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
Bohdan Triapitsyn · OpenChamber
Related CVEs — Bohdan Triapitsyn OpenChamber

In the same product, most dangerous first.

CVE-2026-53975CRITICALOpenChamber 1.11.7 Unauthenticated RCE via /api/fs/execEPSS 1.7%CVE-2026-53977HIGHOpenChamber 1.11.7 Unauthenticated DoS via /api/system/shutdownEPSS 1.0%